import type { IncomingMessage } from 'node:http';
export interface PreviewIdentity {
    project: string;
    thread: string;
    worktree: string;
    target: string;
    session: string;
    revision: string;
}
/** Narrow credentials for one preview origin. Never accepts a gateway API key. */
export declare class PreviewAccess {
    readonly origin: string;
    readonly parentOrigin: string;
    private readonly now;
    private readonly lifetimeMs;
    private grants;
    private sessions;
    readonly cookieName: string;
    constructor(origin: string, parentOrigin: string, now?: () => number, lifetimeMs?: number);
    private prune;
    /** Called only after the gateway verifies access to the owning thread. */
    issueGrant(): string;
    exchange(token: string, origin: string | undefined): string | undefined;
    authorized(req: IncomingMessage): boolean;
    revoke(): void;
}
//# sourceMappingURL=access.d.ts.map